Lookup Process Name by Memory Address on Windows XP - Vol-users - volatilityfoundation.org

Lookup Process Name by Memory Address on Windows XP

Re: [Vol-users] Help to add new...

Help to add new plugin

Matthew Wong

13 Nov 2013 13 Nov '13

8:22 a.m.

Hello All, I'm new to Volatility. Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to? -- matt

Attachments:

attachment.html (text/html — 907 bytes)

Reply

Show replies by date

Glenn Edwards

13 Nov 13 Nov

10 a.m.

The yarascan plugin is good for this situation. - Glenn @hiddenillusion :: sent from my phone, please excuse any typos :: On Nov 13, 2013 8:41 AM, "Matthew Wong" <matthew(a)coredumps.net> wrote:

Hello All, I'm new to Volatility. Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to? -- matt _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

Reply

Jamie Levy

10 a.m.

Hi Matt, Welcome to the users list! Yes there is a way to do that, you can use the `strings` plugin: http://code.google.com/p/volatility/wiki/CommandReference23#strings Let us know if you have any other questions. All the best, -gleeda On Wed, Nov 13, 2013 at 8:22 AM, Matthew Wong <matthew(a)coredumps.net> wrote:

Hello All, I'm new to Volatility. Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to? -- matt _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

-- PGP Fingerprint: 2E87 17A1 EC10 1E3E 11D3 64C2 196B 2AB5 27A4 AC92

Reply

Vico Marziale

10:15 a.m.

Check this out: https://code.google.com/p/volatility/wiki/CommandReference#strings On Wed, Nov 13, 2013 at 7:22 AM, Matthew Wong <matthew(a)coredumps.net> wrote:

Hello All, I'm new to Volatility. Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to? -- matt _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

Reply

Matthew Wong

8:46 p.m.

Thanks all! Could Volatility able to generate a complete memory dump? Or I need to use other tools? -- matt On Wed, Nov 13, 2013 at 11:15 PM, Vico Marziale <vicodark(a)gmail.com> wrote:

Check this out: https://code.google.com/p/volatility/wiki/CommandReference#strings On Wed, Nov 13, 2013 at 7:22 AM, Matthew Wong <matthew(a)coredumps.net>wrote:

Hello All, I'm new to Volatility. Say I found the string "password=hello world" somewhere in the memory, is there anyway for me to know which process that memory block is currently allocated to? -- matt _______________________________________________ Vol-users mailing list Vol-users(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-users

Reply

4018

days inactive

4019

days old

vol-users@lists.volatilityfoundation.org

Manage subscription

4 comments

4 participants

tags (0)

participants (4)

Glenn Edwards
Jamie Levy
Matthew Wong
Vico Marziale